Standardizing the Generation and Signing of Boot Images
summary
Custom vendor signing scripts get replaced by Binman device-tree descriptions that pack and sign complex boot images for TI K3 SoCs, removing external repos and long shell scripts. Build uses U-Boot integration, custom entry types like TI secure, and OpenSSL as a bin tool. Binman enforces tests (100% code coverage) and supports runtime symbol fixes, templating and Fit generation, producing signed, reproducible SPL+firmware binaries that the team reports as working in upstream flows.
AI-written summary · about
chapters (13)
- 0:00Boot image standardization
- 1:03Motivation for standardization
- 2:28U-Boot and firmware overview
- 3:13Bootloader complexity evolution
- 8:17Heterogeneous SoC boot flow
- 10:26Security and authenticated boot
- 11:54Legacy custom scripts challenges
- 14:10Introducing binman tool
- 18:54Extending binman use cases
- 20:18Migration to binman in TI K3
- 23:11TI secure entry design
- 25:44Advantages of binman
- 27:13Current and future developments
related talks
28mStandardizing the Generation and Signing of Boot Images
42mPractical Application of Verified Boot
49mSecure Boot from A to Z- 42mPractical Application of Verified Boot
42mBecoming a tyrant: Implementing secure boot in embedded devices
55mVerified Boot: From ROM to Userspace
39mSecuring firmware: Secure and Trusted boot in OpenBMC
46mVerifiable End To End Secure OCI Native Machines